Remove PlaySearchNow

From the EtreCheck report:

"

Configuration Profiles:

Information not available"

1 . Do you see any Profile listed that you have not added knowingly?

Profiles

System Preferences > Profiles

Launch System Preferences. Do you see any profiles added to the pane at the bottom?

If you see Profiles listed, click on it.

When the Profiles pane opens, select the profile and click the “-“ button at the bottom left corner to remove it.

2. See my post here.

How to remove a configuration profile? https://support.apple.com/kb/PH25680?locale=en_US

2. See my post here. https://discussions.apple.com/thread/8581034

Please run EtreCheck and post the report here.

https://itunes.apple.com/app/etrecheck/id1423715984?mt=12

Click View in Mac App Store button and then “Get” button underneath EtreCheck logo.

Download, install, click “Open’ in the dialog and run it.

Click “Share Report” button in the toolbar, select “Copy to Clipboard” .

Paste it into the reply.

I don't see anything abnormal in the Etrecheck report. When you downloaded an updated Malwarebytes version while in the Safe Mode, did you reboot normally and run the updated Malwarebytes version while booted normally?

Something else to try.

Removing Play Search Now

I'm having the same issue with PlaySearchNow. I've tried all the suggested ways to remove it, unsuccessfully. This is super aggravating. Malwarebytes comes up clean with my previously installed version and a fresh one I had installed while in safe mode. I've tried the manual steps to remove it, but can't seem to find any sign of it. When the problem first occurred, there was an extension in safari for AnySearch, which I removed to trash and then emptied.

At your suggestion, I ran EtreCheck. Here is the output. Do you see anything that is concerning? Or have any additional suggestions to try?

EtreCheck version: 5.0 (5008)

Report generated: 2018-10-13 10:40:27

Download EtreCheck from https://etrecheck.com

Runtime: 2:30

Performance: Excellent

Sandbox: Enabled

Full drive access: Disabled

Problem: Other problem

Description:

Safari homepage highjacked by PlaySearchNow

Major Issues: None

Minor Issues:

These issues do not need immediate attention but they may indicate future problems.

Unsigned files- There are unsigned software files installed. They appear to be legitimate but should be reviewed.

32-bit Apps- This machine has 32-bits apps that may have problems in the future.

Hardware Information:

MacBook Air (11-inch, 2013 - 2014)

MacBook Air Model: MacBookAir6,1

1 1.4 GHz Intel Core i5 (i5-4260U) CPU: 2-core

8 GB RAM - Not upgradeable

BANK 0/DIMM0 - 4 GB DDR3 1600 ok

BANK 1/DIMM0 - 4 GB DDR3 1600 ok

Battery: Health = Normal - Cycle count = 126

Video Information:

Intel HD Graphics 5000 - VRAM: 1536 MB

Color LCD 1366 x 768

Drives:

disk0 - APPLE SSD TS0256F 251.00 GB (Solid State - TRIM: Yes)

Internal PCI 5.0 GT/s x2 Serial ATA

disk0s1 - EFI (MS-DOS FAT32) [EFI] 210 MB

disk0s2 [APFS Container] 250.79 GB

disk1 [APFS Virtual drive] 250.79 GB (Shared by 4 volumes)

disk1s1 - Macintosh HD (APFS) (Shared - 32.36 GB used)

disk1s2 - Preboot (APFS) [APFS Preboot] (Shared)

disk1s3 - Recovery (APFS) [Recovery] (Shared)

disk1s4 - VM (APFS) [APFS VM] (Shared - 1.07 GB used)

Mounted Volumes:

disk1s1 - Macintosh HD 250.79 GB (216.68 GB free)

APFS

Mount point: /

disk1s4 - VM [APFS VM] (Shared - 1.07 GB used)

APFS

Mount point: /private/var/vm

Network:

Interface Bluetooth-Modem: Bluetooth DUN

Interface en3: iPhone

Interface en0: Wi-Fi

802.11 a/b/g/n/ac

Interface en2: Bluetooth PAN

Interface bridge0: Thunderbolt Bridge

System Software:

macOS High Sierra 10.13.6 (17G65)

Time since boot: Less than an hour

Configuration Profiles:

Information not available

Security:

Unsigned Files:

Launchd: ~/Library/LaunchAgents/com.spotify.webhelper.plist

Executable: ~/Library/Application Support/Spotify/SpotifyWebHelper

Details: Exact match found in the whitelist - probably OK

Launchd: /Library/LaunchDaemons/com.citrix.ctxusbd.plist

Executable: /Library/Application Support/Citrix Receiver/ctxusbd

Details: Exact match found in the whitelist - probably OK

32-bit Applications:

2 32-bit apps

Kernel Extensions:

/Library/Application Support/Citrix Receiver

CitrixGUSB.kext (Citrix Systems, Inc., 12.5.0 - SDK 10.9)

System Launch Agents:

System Launch Daemons:

Launch Agents:

Launch Daemons:

User Launch Agents:

User Login Items:

Canon IJ Network Scanner Selector2 (? - installed 2015-01-06)

(/Library/Printers/Canon/IJScanner/Utilities/Canon IJ Network Scanner Selector2.app/Contents/MacOS/Canon IJ Network Scanner Selector2)

iTunesHelper (Apple - installed 2018-08-24)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app/Contents/MacOS/iTunesH elper)

Internet Plug-ins:

Silverlight: 5.1.50901.0 (installed 2017-07-27)

FlashPlayer-10.6: 31.0.0.122 (installed 2018-10-12)

Flash Player: 31.0.0.122 (installed 2018-10-12)

QuickTime Plugin: 7.7.3 (installed 2018-08-24)

CitrixICAClientPlugIn: 12.5.0 (installed 2017-03-30)

3rd Party Preference Panes:

Flash Player (installed 2018-09-21)

Time Machine:

Time Machine information not available

Performance:

System Load: 1.00 (1 min ago) 1.21 (5 min ago) 1.54 (15 min ago)

Nominal I/O speed: 1.75 MB/s

File system: 51.08 seconds

Write speed: 478 MB/s

Read speed: 627 MB/s

CPU Usage:

Top Processes by CPU:

Top Processes by Memory:

Top Processes by Network Use:

Virtual Memory Information:

Software Installs (past 30 days):

End of report

Actually there is not even an icon for profiles. Is there supposed to be?

I followed the link from Eric Root above that provided instructions to change "New Window Open With" from "Tabs from new page" to "Homepage". Success!!!

Thanks all for your input!

I also suffered a common browser hijack (PlaySearchNow) from malware likely embedded in a fake adobe plug in from some website. nasty stuff. i was unable to follow the normal solution, which is start up MacBook in safe mode, as the malware likely did something to make that startup hang. and then run Malwarebytes as recommended in various chatrooms. safe mode is necessary so that the malware doesn't reinstall itself continually. I am a norton subscriber and i was able to get the problem solved quickly by their Spyware and Antivirus team in an online chat, where they took control of my laptop and removed the offending file(s). so far so good! highly recommended as I would have wasted hours trying to find a way to get to safe mode startup.

maybe it has created an entry in Profiles. Try to delete it too.
[Link Edited by Host]

Please use the manual method or Malwarebytes. Do not download any other programs.

Play Search Now uninstall

Play Search Now uninstall (2)

Play Search Now uninstall (3)

This link contained the answer. Thanks so much for your help!

You are welcome.